CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.

• CWE-696

• https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697
• https://github.com/gitpython-developers/GitPython/pull/2264
• https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11414A hard-coded cryptographic key is used by Altium Enterprise …9.8
• CVE-2026-114140The nbconvert tool, jupyter nbconvert, converts Jupyter note…8.8
• CVE-2026-114141toml-node is a TOML parser for Node.js and the browser. Prio…8.7
• CVE-2026-114142toml-node is a TOML parser for Node.js and the browser. Prio…8.8
• CVE-2026-114143toml-node is a TOML parser for Node.js and the browser. Prio…8.7
• CVE-2026-114144toml-node is a TOML parser for Node.js and the browser. Prio…7.5
• CVE-2026-11415Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-11416MoviePilot contains a path traversal vulnerability in the Al…8.1
• CVE-2026-11417OS command injection in the NodejsFunction local bundling pi…7.3
• CVE-2026-114175Missing Authorization vulnerability in DigitalME eRoom eroom…5.4
• CVE-2026-114176Missing Authorization vulnerability in DigitalME eRoom eroom…4.3
• CVE-2026-114177Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro…8.8